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Abstract 

We propose a modular method for proving termination of general logic programs (i.e., 
logic programs with negation). It is based on the notion of acceptable programs, but it 
allows us to prove termination in a truly modular way. We consider programs consisting of 
a hierarchy of modules and supply a general result for proving termination by dealing with 
each module separately. For programs which are in a certain sense well-behaved, namely 
well-moded or well-typed programs, we derive both a simple verification technique and an 
iterative proof method. Some examples show how our system allows for greatly simplified 
proofs. 



1 Introduction 

It is standard practice to tackle a large proof by decomposing it into more managea- 
ble pieces (lemmata or modules) and proving them separately. By composing appro- 
priately these simpler results, one can then obtain the final proof. This methodology 
has been recognized an important one also when proving termination of logic pro- 
grams. Moreover most practical logic programs are engineered by assembling dif- 
ferent modules and libraries, some of which might be pre-compiled or written in a 
different programming language. In such a situation, a compositional methodology 
for proving termination is of crucial importance. 

The first approach to modular termination proofs of logic programs has been 
proposed by Apt and Pedreschi in (Apt and Pedreschi 1994). It extends the seminal 
work on acceptable programs (Apt and Pedreschi 1993) which provides an algebraic 
characterization of programs terminating under Prolog left-to-right selection rule. 
The class of acceptable programs contains programs which terminate on ground 
queries. To prove acceptability one needs to determine a measure on literals (level 
mapping) such that, in any clause, the measure of the head is greater than the 
measure of each body literal. This implies the decreasing of the measure of the 
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literals resolved during any computation starting from a ground or bounded query 
and hence termination. 

The significance of a modular approach to termination of logic programs has been 
recognized also by other authors; more recent proposals can be found in (Pedreschi 
and Ruggieri 1996, Marchiori 1996, Verbaeten, Sagonas and De Schreye 1999, Etalle, 
Bossi and Cocco 1999, Verbaeten, Sagonas and De Schreye 2001). 

All previous proposals (with the exception of (Verbaeten et al. 1999, Etalle et al. 
1999)) require the existence of a relation between the level mappings used to prove 
acceptability of distinct modules. This is not completely satisfactory: it would be 
nice to be able to put together modules which were independently proved termi- 
nating, and be sure that the resulting program is still terminating. 

We propose a modular approach to termination which allows one to reason inde- 
pendently on each single module and get a termination result on the whole program. 
We consider general logic programs, i.e., logic programs with negation, employing 
SLDNF-rcsolution together with the leftmost selection rule (also called LDNF- 
resolution) as computational mechanism. We consider programs which can be di- 
vided into modules in a hierarchical way, so that each module is an extension of the 
previous ones. We show that in this context the termination proof of the entire pro- 
gram can be given in terms of separate proofs for each module, which are naturally 
much simpler than a proof for the whole program. While assuming a hierarchy still 
allows one to tackle most real-life programs, it leads to termination proofs which, 
in most cases, are extremely simple. 

We characterize the class of queries terminating for the whole program by intro- 
ducing a new notion of boundedness, namely strong boundedness. Intuitively, strong 
boundedness captures the queries which preserve (standard) boundedness through 
the computation. By proving acceptability of each module wrt. a level mapping 
which measures only the predicates defined in that module, we get a termination 
result for the whole program which is valid for any strongly bounded query When- 
ever the original program is decomposed into a hierarchy of small modules, the 
termination proof can be drastically simplified with respect to previous modular 
approaches. Moreover strong boundedness can be naturally guaranteed by common 
persistent properties of programs and queries, namely properties preserved through 
LDNF-rcsolution such as well-modedness (Dembihski and Maluszyhski 1985) or 
well-typedness (Bronsard, Lakshman and Reddy 1992). 

The paper is organized as follows. Section 2 contains some preliminaries. In par- 
ticular we briefly recall the key concepts of LDNF-resolution, acceptability, bound- 
edness and program extension. Section 3 contains our main results which show how 
termination proofs of separate programs can be combined to obtain proofs of larger 
programs. In particular we define the concept of strongly bounded query and we 
prove that for general programs composed by a hierarchy of n modules, each one 
independently acceptable wrt. its own level mapping, any strongly bounded query 
terminates. In Section 4 we show how strong boundedness is naturally ensured 
by some program properties which are preserved through LDNF-resolution such as 
well-modedness and well-typedness. In Section 5 we show how these properties allow 
us to apply our general results also for proving termination of modular programs 
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in an iterative way. In Section 6 we compare our work with Apt and Pedreschi's 
approach. Other related works and concluding remarks are discussed in Section 7. 

2 Preliminaries 

We use standard notation and terminology of logic programming (Lloyd 1987, Apt 
1990, Apt 1997). Just note that general logic programs are called in (Lloyd 1987) 
normal logic programs. 

2.1 General Programs and LDNF-Resolution 

A general clause is a construct of the form 

H <— Li, . . . , L n 

with (n > 0), where H is an atom and L\, . . . , L n are literals (i.e., either atoms or 
the negation of atoms). In turn, a general query is a possibly empty finite sequence 
of literals L\, . . . ,L n , with (n > 0). A general program is a finite set of general 
clauses 1 . Given a query Q := L\, . . . ,L n , a non-empty prefix of Q is any query 
Li, . . . ,Li with i G {1, . . . , n}. For a literal L, we denote by rel(L) the predicate 
symbol of L. 

Following the convention adopted in (Apt 1997), we use bold characters to denote 
sequences of objects (so that L indicates a sequence of literals L\, . . . , L n , while t 
indicates a sequence of terms t\, . . . , t n ). 

For a given program P, we use the following notations: Bp for the Hcrbrand base 
of P, ground(P) for the set of all ground instances of clauses from P, comp(P) for 
the Clark's completion of P (Clark 1978). 

Since in this paper we deal with general queries, clauses and programs, we omit 
from now on the qualification "general" , unless some confusion might arise. 

We consider LDNF-resolution, and following Apt and Pedreschi's approach in 
studying the termination of general programs (Apt and Pedreschi 1993), we view 
LDNF-resolution as a top-down interpreter which, given a general program P and 
a general query Q, attempts to build a search tree for P U {Q} by constructing 
its branches in parallel. The branches in this tree are called LDNF- derivations of 
P U {Q} and the tree itself is called LDNF-tree of P U {Q}- Negative literals are 
resolved using the negation-as-failure rule which calls for the construction of a sub- 
sidiary LDNF-tree. If during this subsidiary construction the interpreter diverges, 
the (main) LDNF-derivation is considered to be infinite. An LDNF-dcrivation is 
finite also if during its construction the interpreter encounters a query with the 
first literal being negative and non-ground. In such a case we say that the LDNF- 
derivation flounders. 

1 In the examples through the paper, we will adopt the syntactic conventions of Prolog so that 
each query and clause ends with the period "." and "<— " is omitted in the unit clauses. 
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By termination of a general program we actually mean termination of the under- 
lying interpreter. Hence in order to ensure termination of a query Q in a program 
P, we require that all LDNF-derivations of P U {Q} are finite. 

By an LDNF-descendant of P U {Q} we mean any query occurring during the 
LDNF- resolution of P U {Q}, including Q and all the queries occurring during the 
construction of the subsidiary LDNF-trees for P U {Q}- 

For a non-empty query Q, we denote by first (Q) the first literal of Q. Moreover 
we define Call P (Q) = {first{Q') \ Q' is an LDNF-descendant of P U {Q}}. It is 
worth noting that if ->A e Callp(Q) and A is a ground atom, then A 6 Callp{Q) 
too. Notice that, for definite programs, the set Callp{Q) coincides with the call 
set Call(P, {Q}) in (De Schreye, Verschaetse and Bruynooghe 1992, Decorte, De 
Schreye and Vandecasteele 1999). 

The following trivial proposition holds. 

Proposition 1 

Let P be a program and Q be a query. All LDNF-derivations of P U {Q} are finite 
iff for all positive literals A 6 Callp(Q), all LDNF-derivations of PL) {A} are finite. 

2.2 Acceptability and Boundedness 

The method we are going to use for proving termination of modular programs is 
based on the concept of acceptable program (Apt and Pedreschi 1993). In order to 
introduce it, we start by the following definition, originally due to (Bezem 1993) 
and (Cavedon 1989). 

Definition 2 {Level Mapping) 

A level mapping for a program P is a function | | : Bp — > N of ground atoms to 
natural numbers. By convention, this definition is extended in a natural way to 
ground literals by putting \^A\ = \A\. For a ground literal L, \L\ is called the level 
of L. 

We will use the following notations. Let P be a program and p and q be relations. 
We say that p refers to q if there is a clause in P that uses p in its head and q in 
its body; p depends on q if (p, q) is in the reflexive, transitive closure of the relation 
refers to. We say that p and q are mutually recursive and write p ~ q, if p depends 
on q and q depends on p. We also write p □ q, when p depends on q but q does not 
depend on p. 

We denote by Neg P the set of relations in P which occur in a negative literal in 
a clause of P and by Neg* P the set of relations in P on which the relations in Neg P 
depend. P~ denotes the set of clauses in P defining a relation of Neg* P . 

In the sequel we refer to the standard definition of model of a program and model 
of the completion of a program, see (Apt 1990, Apt 1997) for details. In particular 
we need the following notion of complete model for a program. 

Definition 3 {Complete Model) 

A model M of a program P is called complete if its restriction to the relations from 
Negp is a model of comp(P~). 
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Notice that if I is a model of comp(P) then its restriction to the relations in Neg* P 
is a model of comp(P~); hence J is a complete model of P. 

The following notion of acceptable program was introduced in (Apt and Pe- 
dreschi 1993). Apt and Pedreschi proved that such a notion fully characterizes left- 
termination, namely termination wrt. any ground query, both for definite programs 
and for general programs which have no LDNF-derivations which flounder. 

Definition 4 (Acceptable Program) 

Let P be a program, | | be a level mapping for P and M be a complete model of P. 
P is called acceptable wrt. \ \ and M if for every clause A <— A, B, B in ground(P) 
the following implication holds: 

if M \= A then \A\ > \B\. 

Note that if P is a definite program, then both P~ and Neg* P are empty and M 
can be any model of P. 

We also need the notion of bounded atom. 

Definition 5 (Bounded Atom) 

Let P be a program and | be a level mapping for P. An atom A is called bounded 
wrt. | | if the set of all \A'\, where A' is a ground instance of A, is finite. In this 
case we denote by max \A\ the maximum value in this set. 

Notice that if an atom A is bounded then, by definition of level mapping, also 
the corresponding negative literal, -*A, is bounded. 

Note also that, for atomic queries, this definition coincides with the definition 
of bounded query introduced in (Apt and Pedreschi 1993) in order to characterize 
terminating queries for acceptable programs. In fact, in case of atomic queries the 
notion of boundedness does not depend on a model. 

2.3 Extension of a Program 

In this paper we consider a hierarchical situation where a program uses another one 
as a subprogram. The following definition formalizes this situation. 

Definition 6 (Extension) 

Let P and R be two programs. A relation p is defined in P if p occurs in a head 
of a clause of P; a literal L is defined in P if rel(L) is defined in P; P extends R, 
denoted P □ R, if no relation defined in P occurs in R. 

Informally, P extends R if P defines new relations with respect to R. Note that 
P and R are independent if no relation defined in P occurs in R and no relation 
defined in R occurs in P, i.e. P □ R and R □ P. 

In the sequel we will study termination in a hierarchy of programs. 

Definition 7 (Hierarchy of Programs) 

Let Pi, . . . , P n be programs such that for all i <E {1, . . . ,n— 1}, P,+i □ (PiU- • - UP,). 
Then we call P n □ • • • □ Pi a hierarchy of programs. 
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3 Hierarchical Termination 

This section contains our main results which show how termination proofs of sepa- 
rate programs can be combined to obtain proofs of larger programs. We start with 
a technical result, dealing with the case in which a program consists of a hierar- 
chical combination of two modules. This is the base both of a generalization to a 
hierarchy of n programs and of an iterative proof method for termination presented 
in Section 5. Let us first introduce the following notion of P '-closed class of queries. 

Definition 8 (P-closed Class) 

Let C be a class of queries and P be a program. We say that C is P-closed if it 
is closed under non-empty prefix (i.e., it contains all the non-empty prefixes of 
its elements) and for each query Q G C, every LDNF-descendant of P U {Q} is 
contained in C. 

Note that if C is P-closed, then for each query Q G C, Callp(Q) C C. 

We can now state our first general theorem. Notice that if P extends R and P 
is acceptable wrt. some level mapping | | and model M, then P is acceptable also 
wrt. the level mapping | |' and M, where | |' is defined on the Herbrand base of the 
union of the two programs Ppuit an d it takes the value on the literals which are 
not defined in P (and hence, in particular, on the literals which occur in P but are 
defined in R). This shows that in each module it is sufficient to compare only the 
level of the literals defined inside it, while we can ignore literals defined outside the 
module. In the following we make use of this observation in order to associate to 
each module in a hierarchy a level mapping which is independent from the context. 

Theorem 9 

Let P and R be two programs such that P extends R, M be a complete model of 
PUR and C be a (P U P)-closed class of queries. Suppose that 

• P is acceptable wrt. a level mapping | | and M, 

• for all queries Q G C, all LDNF-derivations of R U {Q} are finite, 

• for all atoms A G C, if A is defined in P then A is bounded wrt. | |. 

Then for all queries Q G C, all LDNF-derivations of (P U R) U {Q} are finite. 
Proof 

By the fact that C is (PL) P)-closed and Proposition 1, it is sufficient to prove that 
for all positive literals A G C, all LDNF-derivations of (P U R) Li {A} are finite. Let 
us consider an atom A G C. 

If A is defined in R, then the thesis trivially holds by hypothesis. 

If A is defined in P, A is bounded wrt. | | by hypothesis and thus moa;|^4| is 
defined. The proof proceeds by induction on maa;|A|. 

Base. Let max\A\ = 0. In this case, by acceptability of P, there are no clauses 
in P whose head unifies with A and whose body is non-empty. Hence, the thesis 
holds. 

Induction step. Let maa;|yl| > 0. It is sufficient to prove that for all direct descen- 
dants (L\, . . . , L n ) in the LDNF-tree of (PL) R)D {A}, if 6i is a computed answer 
for P U {I-i, . . . , Lj-i} then all LDNF-derivations of (P U R) L) {Lrfi} are finite. 
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Let c : H' <— L\, . . . , L' n be a clause of P such that a — mgu(H', A). Let H = H'a 
and for all i G {1, . . . , n}, let = L-ct and #j be a substitution such that 9i is a 
computed answer of L\, . . . , Lj_i in P U P. 

We distinguish two cases. If Li is defined in P then the thesis follows by hypoth- 
esis. 

Suppose that Li is defined in P. We prove that Lfii is bounded and moa;|A| > 
max\Li9i\. The thesis will follow by the induction hypothesis. 

Let 7 be a substitution such that LiO^f is ground. By soundness of LDNF- 
resolution (Clark 1978), there exists 7' such that M \= (L\, . . . ,1.^1)7' and ca-f' 
is a ground instance of c and £-,7' = Li$ij. Therefore 



Since A is bounded, we can conclude that Lj#j is bounded and also that max\A\ > 
max\Li6i\. □ 

We are going to extend the above theorem in order to handle the presence of 
more than two modules. We need to introduce more notation. Let us consider the 
case of a program P consisting of a hierarchy R n □ . . . □ R\ of distinct modules, 
and satisfying the property that each module, Pi, is acceptable wrt. a distinct 
level mapping, | |j, and a complete model, M, of the whole program. Under these 
assumptions we identify a specific class of queries which terminate in the whole 
program. We characterize the class of terminating queries in terms of the following 
notion of strong boundedness. This class enjoys the property of being P-closed. 

Definition 10 {Strongly Bounded Query) 

Let the program P := Ri U . . . U R n be a hierarchy R n □ . . . □ Ri and | |i, . . . , | |„ 
be level mappings for R\, . . . , R ni respectively. A query Q is called strongly bounded 
wrt. P and \ |i, . . . , |„ if 

• for all atoms A 6 Callp(Q) 1 if A is defined in Ri (with i G {1, . . . , n}) then 
A is bounded wrt. | \i. 

Notice that the notion of boundedness for an atom (see Definition 5) does not 
depend on the choice of a particular model of P. As a consequence, also the defi- 
nition of strong boundedness does not refer to any model of P; however, it refers 
to the LDNF-derivations of P. For this reason, a ground atom is always bounded 
but not necessarily strongly bounded. On the other hand, if A is strongly bounded 
then it is bounded too. 

The following remark follows immediately. 

Remark 11 

Let the query Q be strongly bounded wrt. P and | |i, . . . , | |„, where P is a hierarchy 
R n □ • • • □ Ri . Let i G {1, . . . , n}. If Q is defined in Ri U. . .UR4 then Q is strongly 
bounded wrt. Pi U ... U Ri and | |i, . . . , | \i. 



LiOa\ = 




< 



(since Li — L^a) 
(since P is acceptable) 
(since a = mgu(H', A)). 
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In order to verify whether a query Q is strongly bounded wrt. a given program P 
one can perform a call-pattern analysis (Janssen and Bruynooghe 1992, Gabbriclli 
and Giacobazzi 1994, Codish and Demoen 1995) which allows us to infer information 
about the form of the call-patterns, i.e., the atoms that will be possibly called 
during the execution of P U {Q}- However this is not the only way for guaranteeing 
strong boundcdncss. There are classes of programs and queries for which strong 
boundedness can be proved in a straightforward way. This is shown in the following 
section. 

Let us illustrate the notion of strong boundedness through an example. 
Example 12 

Let LIST01 be the following program which defines the proper lists of O's and l's, 
i.e. lists containing only O's and l's and at least two distinct elements, as follows: 

rl: list01([ ] ,0,0) . 

r2: list01([0|Xs] ,s(N0) ,N1) <- list01(Xs,N0,Nl) . 
r3: listOK [1 IXs] ,N0,s(Nl)) <- list01(Xs,N0,Nl) . 

r4: length([ ] ,0) . 

r5: length([X|Xs] ,s(N)) <- length (Xs ,N) . 

r6: plistOl(Ls) <- list01(Ls,N0,Nl) , 

-■length (Ls, NO) , ->length(Ls,Nl) . 

Let us distinguish two modules in LIST01: R\ = {ri, r 2 , r 3 , r 4 , r 5 } and R 2 = {r 6 } 
(i?2 extends Let | |i be the natural level mapping for i?i defined by: 

|list01(fe, nO, nl)\i = |/s|i ength 
|length(fe, n)\i = |n| size 

where for a term t, if t is a list then |i|i en gth is equal to the length of the list, 
otherwise it is 0, while |£| S i Ze is the number of function symbols occurring in the 
term t. Let also | | 2 be the trivial level mapping for R 2 defined by: 

|plist01(te)| 2 = 1 

and assume that \L\ 2 = 0, if L is not defined in R 2 . 

Let us consider the following sets of atomic queries for LIST01 := R\ U R 2 - 

Qi = {list01(fe, nO, nl )| Is is a list, possibly non-ground, of a fixed length}; 
Q 2 = {length(k, n)\ n is a ground term of the form either or s (s (... (0) ) )}; 
<2 3 = {plist01(fe)| Is is a list, possibly non-ground, of a fixed length}. 

By definition of | |i, all the atoms in Qi and Q 2 are bounded wrt. | |i. Analogously, 
all the atoms in Q3 are bounded wrt. | \ 2 . Notice that for all atoms A e Callp(Qj), 
with j G {1, 2, 3}, there exists k G {1, 2, 3} such that A G Qk- Hence, if A is defined 
in Ri then A is bounded wrt. | |i. This proves that the set of queries Qi, Q 2 and 
Qz are strongly bounded wrt. LIST01 and | |i, | \ 2 . 

Here we introduce our main result. 
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Theorem 13 

Let P := R\ U . . . U R n be a program such that Rn □ . . . □ R\ is a hierarchy, 
|i, . . . , | |„ be level mappings for Ri, . . . , R n , respectively, and M be a complete 
model of P. Suppose that 

• Ri is acceptable wrt. | \i and M, for all i G {1, 

• Q is a query strongly bounded wrt. P and | |i, 

Then all LDNF-derivations of P U {Q} arc finite. 
Proof 

Let Q be a query strongly bounded wrt. P and | |i, . . . , |„. We prove the theorem 
by induction on n. 

Base. Let n = 1. This case follows immediately by Theorem 9, where P = R±, R 
is empty and C is the class of strongly bounded queries wrt. Ri and | |i, and the 
fact that a strongly bounded atom is also bounded. 

Induction step. Let n > 1. Also this case follows by Theorem 9, where P = R n , 
R = R\ U. . . Ui?„_i and C is the class of strongly bounded queries wrt. R\ U. . .UR n 
and | |i, . . . , | |„. In fact, 

• R n is acceptable wrt. | |„ and M; 

• for all queries Q G C, all LDNF-derivations of (i?i U . . . U R n -i) U {Q} are 
finite, by Remark 11 and the inductive hypothesis; 

• for all atoms A G C, if A is defined in i?„ then A is bounded wrt. | |„, by 
definition of strong boundedness. 

□ 

Here are a few examples applying Theorem 13. 
Example 14 

Let us reconsider the program of Example 12. In the program LIST01, R\ and 
i? 2 are acceptable wrt. any complete model and the level mappings | |i and | | 2 , 
respectively. We already showed that Qi,Q,2 and Q3 are strongly bounded wrt. 
LIST01 and | |i, | | 2 . Hence, by Theorem 13, all LDNF-derivations of LIST01 U {Q}, 
where Q is a query in Qi, Q 2 or Q 3 , are finite. 

Notice that in the previous example the top module in the hierarchy, i? 2 , contains 
no recursion. Hence it is intuitively clear that any problem for termination cannot 
depend on it. This is reflected by the fact that the level mapping for R 2 is completely 
trivial. This shows how the hierarchical decomposition of the program can simplify 
the termination proof. 

Example 15 

Consider the sorting program MERGES DRT (Apt 1997): 

cl: mergesort([ ],[ ]). 
c2: mergesort( [X] , [X] ) . 
c3: mergesort( [X,Y|Xs] ,Ys) <- 

split([X,Y|Xs] ,Xls,X2s) , 
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mergesort (Xls , Yls) , 
mergesort (X2s , Y2s) , 
merge (Yls, Y2s,Ys) . 

c4: split ([ ],[ ] , [ ]). 

c5: split([X|Xs] , [XlYs] ,Zs) <- split(Xs,Zs,Ys) . 

c6: merge([ ],Xs,Xs). 

c7: merge (Xs,[ ] ,Xs) . 

c8: merge([X|Xs] , [YlYs] , [XlZs]) ^X<=Y, merge (Xs , [Y I Ys] , Zs) . 

c9: merge([X|Xs] , [YlYs] , [YlZs]) ^X>Y, merge( [X|Xs] ,Ys,Zs) . 

Let us divide the program MERGESORT into three modules, R\, R 2 , R3, such that 
i?3 □ i?2 □ Ri as follows: 

• i?3 := {cl, c2, c3}, it defines the relation mergesort, 

• i?2 := {c4, c5}, it defines the relation split, 

• R\ :— {c6, c7, c8, c9}, it defines the relation merge. 

Let us consider the natural level mappings 

|merge(a;s, ys, zs)|i = |a;s|i en g th + \ys\ lengt h 

|split(xs, ys, zs)\ 2 = |a;s|i e ngth 

|mergesort(a;s, ys)\ 3 = |xs| length 

and assume that for all i G {1, 2, 3}, \L\± = if L is not defined in Ri. 

All ground queries are strongly bounded wrt. the program MERGESORT and the 
level mappings | |i, | | 2 , | I3. Moreover, since the program is a definite one, R\ and 
R 2 are acceptable wrt. any model and the level mappings | |i and | I2, respectively, 
while i?3 is acceptable wrt. the level mapping | I3 and the model M below: 

M =[mergesort(Xs, Ys)] U [merge(Xs, Ys, Zs)]U 
{split([],[],[])}U 

{split([a;], [ ], [x])\ x is any ground term}U 
{split([x], [x], [ ])| x is any ground tcrm}U 
{split(xs, ys, zs)\ xs, ys, zs are ground terms and 

\xs\l en gth > 2, \xs\l en gth > \ys\length, \^s\ length > |^| length} 

where we denote by [A] the set of all ground instances of an atom A. 

Hence, by Theorem 13, all LDNF-derivations of MERGESORT U {Q}, where Q is a 
ground query, are finite. 

Note that by exchanging the roles of i?i and R2 we would obtain the same result. 
In fact the definition of merge and split are independent from each other. 

4 Well-Behaving Programs 

In this section we consider the problem of how to prove that a query is strongly 
bounded. In fact one could argue that checking strong boundedness is more difficult 
and less abstract than checking boundedness itself in the sense of (Apt and Pedreschi 
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1993): we have to refer to all LDNF-derivations instead of referring to a model, 
which might well look like a step backwards in the proof of termination of a program. 
This is only partly true: in order to check strong boundcdness we can either employ 
tools based on abstract interpretation or concentrate our attention only on programs 
which exhibit useful persistence properties wrt. LDNF-resolution. 

We now show how the well-established notions of well-moded and well-typed 
programs can be employed in order to verify strong boundedness and how they can 
lead to simple termination proofs. 

4-1 Well-Moded Programs 

The concept of a well-moded program is due to (Dembinski and Maluszynski 1985). 
The formulation we use here is from (Roscnblucth 1991), and it is equivalent to that 
in (Drabent 1987). The original definition was given for definite programs (i.e., 
programs without negation), however it applies to general programs as well, just 
by considering literals instead of atoms. It relies on the concept of mode, which is 
a function that labels the positions of each predicate in order to indicate how the 
arguments of a predicate should be used. 

Definition 16 (Mode) 

Consider an n-ary predicate symbol p. By a mode for p we mean a function m p 
from {1, . . . , n} to the set {+, — }. If m p (i) = + then we call i an input position 
of p; if m p (i) = — then we call i an output position of p. By a moding we mean a 
collection of modes, one for each predicate symbol. 

In a moded program, we assume that each predicate symbol has a unique mode 
associated to it. Multiple moding may be obtained by simply renaming the predi- 
cates. We use the notation p(m p (l), . . . ,m p (n)) to denote the moding associated 
with a predicate p (e.g., append(+, +, — )). Without loss of generality, we assume, 
when writing a literal as p(s, t), that we are indicating with s the sequence of terms 
filling in the input positions of p and with t the sequence of terms filling in the 
output positions of p. Moreover, we adopt the convention that p(s, t) could denote 
both negative and positive literals. 

Definition 17 ( Well-Moded) 

• A query £>i(si, ti), . . . ,p„(s„, t„) is called well-moded if for all i 6 {1, . . . , n} 

i-i 

Var(si) C (J Var(tj). 

3 = 1 

• A clause p(t , s n+ i) <— pi(si, ti), . . . ,p n (s n , t„) is called well-moded if for all 
i G {l,...,n+l} 

i-i 

Var(si) C (J Var(tj). 
j=o 

• A program is called well-moded if all of its clauses are well-moded. 
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Note that well-modedness can be syntactically checked in a time which is linear 
wrt. the size of the program (query). 

Remark 18 

If Q is a well-moded query then all its prefixes are well-moded. 

The following lemma states that well-moded queries are closed under LDNF- 
resolution. This result has been proved in (Apt and Pellegrini 1994) for LD-derivations 
and definite programs. 

Lemma 19 

Let P and Q be a well-moded program and query, respectively. Then all LDNF- 
descendants of P U {Q} are well-moded. 

Proof 

It is sufficient to extend the proof in (Apt and Pellegrini 1994) by showing that if 
a query -<A, L\, . . . ,L n is well-moded and A is ground then both A and L\,...,L n 
are well-moded. This follows immediately by definition of well-modedness. If A is 
non-ground then the query above has no descendant. □ 

When considering well-moded programs, it is natural to measure atoms only in 
their input positions (Etalle et al. 1999). 

Definition 20 (Moded Level Mapping) 

Let P be a moded program. A function | | is a moded level mapping for P if it is a 
level mapping for P such that 

• for any s, t and u, |p(s,t)| = |p(s,u)|. 

Hence in a moded level mapping the level of an atom is independent from the 
terms in its output positions. 

The following Remark and Proposition allow us to exploit well-modedness for 
applying Theorem 13. 

Remark 21 

Let P be a well-moded program. If Q is well-moded, then first(Q) is ground in 
its input position and hence it is bounded wrt. any moded level mapping for P. 
Moreover, by Lemma 19, every well-moded query is strongly bounded wrt. P and 
any moded level mapping for P. 

Proposition 22 

Let P := R\ U . . . U R n be a well-moded program and R n □ . . . □ Ri a hierarchy, 
and | i, . . . , | \ n be moded level mappings for Ri, . . . , R ni respectively. 
Then every well-moded query is strongly bounded wrt. P and | |i, . . . , „. 

Example 23 

Let MOVE be the following program which defines a permutation between two lists 
such that only one element is moved. We introduce modes and we distinguish the 
two uses of append by renaming it as appendl and append2. 
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mode delete(+, — , — ) . 
mode appendl(— , — , +) . 
mode append2(+, +, — ) . 
mode move(+, — ) . 

rl: delete ([X I Xs] ,X,Xs) . 

r2: delete ( [X| Xs] ,Y, [X| Ys] ) <- delete(Xs,Y,Ys) . 

r3: appendK [ ] ,Ys,Ys) . 

r4: appendK [X | Xs] ,Ys, [XI Zs]) <- appendl(Xs,Ys,Zs) . 

r5: append2( [ ] ,Ys,Ys) . 

r6: append2([X|Xs] ,Ys, [XlZs]) <- append2(Xs,Ys,Zs) . 

r7: move(Xs,Ys) <— appendl(Xls,X2s,Xs) , 

delete(Xls,X,Yls) , append2(Yls, [X|X2s] ,Ys) . 

Let us partition MOVE into the modules R\ = {r l7 r 2 , r 3 , r 4 , r B , r 6 } and i? 2 = {^7} 
(i?2 extends R\). Let | |i be the natural level mapping for R\ defined by: 

appendl(zs, ys, zs)\ t = |zs|i engt h 
append2(z.s, ys, zs)\ x = \xs\ length . 
|delete(a;s,a;,j/s)|i = |a;s|i ength . 

i?2 does not contain any recursive definition hence let | 2 be the trivial level mapping 
defined by: 

|move(a;s, ys)\ 2 = 1 

and assume that L| 2 = 0, if L is not defined in i? 2 - 

The program MOVE := R\ U R2 is wcll-modcd and hence by Proposition 22 every 
well-moded query is strongly bounded wrt. MOVE and | |i, | | 2 . 

Example 24 

Let Ri be the program which defines the relations member and is, i? 2 be the 
program defining the relation count and i?3 be the program defining the relation 
dif f with the moding and the definitions below. 

mode member(+, +) . 
mode is(— ,+). 
mode diff (+,+,+, -). 
mode count(+, +, — ) . 

rl: member (X, [X|Xs]) . 

r2: member (X, [Y I Xs] ) <— member (X,Xs) . 

r3: diff (Ls, 11,12, N) <- count (Ls, II, Nl) , count (Ls , 12 ,N2) , 
N is N1-N2. 

r4: count ( [ ] ,1,0) . 

r5: count([H|Ts] ,I,M) <— member (H, I) , count (Ts , I ,M1) , 
M is Ml+1. 

r6: count( [HlTs] ,I,M) <— -. member (H, I) , count (Ts , I ,M) . 
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The relation dif f (Is, il , i2, n), given a list Is and two check-lists il and i2, defines 
the difference n between the number of elements of Is occurring in il and the 
number of elements of Is occurring in i2 . Clearly R3 □ R 2 □ R\ . It is easy to see 
that R\ is acceptable wrt. any complete model and the moded level mapping 

|member(e, /s)|i = |fe|i eng th 
R 2 is acceptable wrt. any complete model and the moded level mapping: 

| count (fe, i, n)\ 2 = |fo|ien g th 
and i? 3 is acceptable wrt. any complete model and the trivial moded level mapping: 

|diff(Zs, il,i2, n)\ 3 = 1 

where \L\± = 0, if L is not defined in Ri. 

The program DIFF := i?i U R2 U R3 is well-moded. Hence, by Proposition 22, 
every well-moded query is strongly bounded wrt. DIFF and | |i, | I2, | |3- 

Note that the class of strongly bounded queries is generally larger than the class 
of well-moded queries. Consider for instance the program MOVE and the query Q := 
move ([XI, X2], Ys), delete(Ys, Y, Zs) which is not well-moded since it is not ground 
in the input position of the first atom. However Q can be easily recognized to be 
strongly bounded wrt. MOVE and | |i, | I2 defined in Example 23. We will come back 
to this query later. 

4-2 Well- Typed Programs 

A more refined well-behavior property of programs, namely well-typedness, can also 
be useful in order to ensure the strong boundedness property. 

The notion of well-typedness relies both on the concepts of mode and type. The 
following very general definition of a type is sufficient for our purposes. 

Definition 25 ( Type) 

A type is a set of terms closed under substitution. 

Assume as given a specific set of types, denoted by Types, which includes Any, 
the set of all terms, and Ground the set of all ground terms. 

Definition 26 [Type Associated with a Position) 

A type for an n-ary predicate symbol p is a function t p from {!,... ,n} to the set 
Types. If t p (i) = T, we call T the type associated with the position i of p. Assuming 
a type t p for the predicate p, we say that a literal p(s\, . . . , s n ) is correctly typed in 
position i if Si £ t p (i). 

In a typed program we assume that every predicate p has a fixed mode m p and 
a fixed type t p associated with it and we denote it by 

p(m p (l) : t p (l), m p (n) : t p (n)). 

So, for instance, we write 
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append(+ : List, + : List, — : List) 

to denote the moded atom append(+, +, — ) where the type associated with each 
argument position is List, i.e., the set of all lists. 

We can then talk about types of input and of output positions of an atom. 

The notion of well-typed queries and programs relies on the following concept of 
type judgement. 

Definition 27 ( Type Judgement) 

By a type judgement we mean a statement of the form s : S ^> t : T. We say that 
a type judgement s : S =>■ t : T is true, and write |= s : S => 1 : T, if for all substi- 
tutions 6, s9 G S implies tO G T. 

For example, the type judgements (x : Nat, I : ListNat) =4> ([x\l] : ListNat) and 
([x\l] : ListNat) (I : ListNat) arc both true. 

A notion of well-typed program has been first introduced in (Bronsard et al. 
1992) and also studied in (Apt and Etalle 1993) and in (Apt and Luitjes 1995). 
Similarly to well-moding, the notion was developed for definite programs. Here we 
extend it to general programs. 

In the following definition, we assume that i 8 : I s is the sequence of typed terms 
filling in the input positions of L s and o s : O s is the sequence of typed terms filling 
in the output positions of L s . 

Definition 28 (Well-Typed) 

• A query L\, . . . , L n is called well-typed if for all j G {1, . . . , n} 

\= o h : O o, : () ij : I 

where Lj 1 , . . . , Lj k are all the positive literals in L\, . . . , Lj_\. 

• A clause L n <— L\, . . . , L n is called well-typed if for all j G {1, ... , n} 

h io : 10,0^ :O h ,..., o jk : Jk => ij : I 3 
where Lj x , . . . , Lj k are all the positive literals in L\, . . . , and 
|= i : I , o n :O n ,..., o jh : O jh => o : O 

where Lj ± , . . . , Lj h are all the positive literals in L\, . . . , L n . 

• A program is called well-typed if all of its clauses are well-typed. 

Note that an atomic query is well-typed iff it is correctly typed in its input positions 
and a unit clause p(s : S, t : T) <— is well-typed if |= s : S =>■ t : T. 

The difference between Definition 28 and the one usually given for definite pro- 
grams is that the correctness of the terms filling in the output positions of negative 
literals cannot be used to deduce the correctness of the terms filling in the input 
positions of a literal to the right (or the output positions of the head in a clause) . 
The two definitions coincide either for definite programs or for general programs 
whose negative literals have only input positions. 

As an example, let us consider the trivial program 
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p(— : List) . 
q(+ : List) . 

p(G). 
q([]). 

By adopting a straightforward extension of well-typedness to normal programs 
which considers also the outputs of negative literals, we would have that the query 
-ip(a),q(a) is well-typed even if a is not a list. Moreover well-typedness would not 
be persistent wrt. LDNF-resolution since q(a), which is the first LDNF-resolvent of 
the previous query, is no more well-typed. Our extended definition and the classical 
one coincide either for definite programs or for general programs whose negative 
literals have only input positions. 

For definite programs, well-modedness can be viewed as a special case of well- 
typedness if we consider only one type: Ground. With our extended definitions of 
well-moded and well-typed general programs this is no more true. We could have 
given a more complicated definition for well-typedness in order to capture also well- 
modedness as a special case. For the sake of simplicity, we prefer to give two distinct 
and simpler definitions. 

Remark 29 

If Q is a well-typed query, then all its non-empty prefixes are well-typed. In partic- 
ular, first(Q) is well- typed. 

The following Lemma shows that well-typed queries are closed under LDNF- 
resolution. It has been proved in (Bronsard et al. 1992) for definite programs. 

Lemma 30 

Let P and Q be a well-typed program and query, respectively. Then all LDNF- 
descendants of P U {Q} are well-typed. 

Proof 

Similarly to the case of well-moded programs, to extend the result to general pro- 
grams it is sufficient to show that if a query Q := -^A, L\, . . . , L n is well-typed then 
both A and L\, . . . , L n are well-typed. In fact, by Remark 29, ~^A — first(Q) is 
well-typed and by Definition 28, if the first literal in a well-typed query is negative, 
then it is not used to deduce well-typedness of the rest of the query. □ 

It is now natural to exploit well-typedness in order to check strong boundedness. 
Analogously to well-moded programs, there are level mappings that are more nat- 
ural in presence of type information. They are the level mappings for which every 
well-typed atom is bounded. By Lemma 30 we have that a well-typed query Q is 
strongly bounded wrt. a well- typed program P and any such level mapping. This 
is stated by the next proposition. 

Proposition 31 

Let P := R\ U . . . U R n be a well-typed program and R n □ . . . □ R\ be a hierarchy, 
and | |i, . . . , | |„ be level mappings for Ri, . . . , R n , respectively. Suppose that for 
every well-typed atom A, if A is defined in Ri then A is bounded wrt. | |j, for i 6 
{1, . . . , n}. Then every well- typed query is strongly bounded wrt. P and | |i, . . . , |„. 
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Example 32 

Let us consider again the modular proof of termination for MOVE := i?i U i? 2 , where 
Ri defines the relations appendl, append2 and delete, while i? 2 , which extends 
Ri, defines the relation move. We consider the moding of Example 23 with the 
following types: 

delete(+ : List, — : Any, — : List) 
appendl (— : List, — : List, + : List) 
append2(+ : List, + : List, — : List) 
move(+ : List, — : List) . 

Program MOVE is well-typed in the assumed modes and types. 

Let us consider the same level mappings as used in Example 23. We have already 
seen that R2 is acceptable wrt. | | 2 and any model, and i?i is acceptable wrt. | |i 
and any model. By definition of | | 2 and |i, one can easily see that 

• every well- typed atom A defined in Ri is bounded wrt. | \i. 
Hence, by Proposition 31, 

• every well- typed query is strongly bounded wrt. MOVE and | |i, | | 2 . 

Let us consider again the query Q := move([Xl, X2], Ys), delete(Ys, Y, Zs) which 
is not wcll-moded but it is well- typed. We have that Q is strongly bounded wrt. 
MOVE and | |i, | | 2 , and consequently, by Theorem 13, that all LDNF-derivations of 
MOVEU {Q} arc finite. 

Example 33 

Consider the program C0L0R_MAP from (Sterling and Shapiro 1986) which generates 
a coloring of a map in such a way that no two neighbors have the same color. The 
map is represented as a list of regions and colors as a list of available colors. In 
turn, each region is determined by its name, color and the colors of its neighbors, 
so it is represented as a term region(name , color .neighbors) , where neighbors 
is a list of colors of the neighboring regions. 

cl: color_map([ ] .Colors) . 

c2: color_map( [Region I Regions] .Colors) <— 

color_region (Region, Colors) , 

colorjnap (Regions, Colors) . 

c3: color_region (region (Name , Color, Neighbors) , Colors) <— 
select (Color .Colors, Colorsl) 
subset (Neighbors, Colorsl) . 

c4: select(X, [XlXs] ,Xs) . 

c5: select(X, [YlXs] , [YlZs]) <- select(X,Xs,Zs) . 

c6: subset ([ ] ,Ys) . 

c7: subset ( [X I Xs] ,Ys) <— member (X,Ys) , subset (Xs ,Ys) . 

c8: member (X, [X|Xs]) . 

c9: member (X, [Y I Xs] ) <— member (X,Xs) . 
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Consider the following modes and types for the program CDLDR_MAP: 

color_map(+ : ListRegion, + : List) 
color_region(+ : Region, + : List) 
select(+ : Any, + : List, — : List) 
subset(+ : List, + : List) 
member(+ : Any, + : List) 

where 

• Region is the set of all terms of the form region (name , color .neighbors) 
with name, color £ Any and neighbors £ List, 

• ListRegion is the set of all lists of regions. 

We can check that CDL0R_MAP is well-typed in the assumed modes and types. 
We can divide the program COLOFLMAP into four distinct modules, R\, R2, R3, R4, 
in the hierarchy R4 □ R3 □ R2 □ i?i as follows: 

• i?4 := {cl, c2} defines the relation color_map, 

• i?3 := {c3} defines the relation color_region, 

• i? 2 : = {c4, c5, c6, c7} defines the relations select and subset, 

• i?i := {c8, c9} defines the relation member. 

Each Ri is trivially acceptable wrt. any model M and the simple level mapping 
|, defined below: 

color_map(xs, ys)| 4 = |xs|ien g th 

color jregion(z, xs)\3 = 1 

\select(x, xs,ys)\ 2 = \xs\ length 
subset(zs, ys)\ 2 = | | length 

|member(:r, xs)\ t = |a;s| len g tn 

where for all i £ {1, 2, 3, 4}, \L\i = 0, if L is not defined in Ri. 

Moreover, for every well-typed atom A and i £ {1,2,3,4}, if A is defined in Ri 
then A is bounded wrt. | |j. Hence, by Proposition 31, 

• every well-typed query is strongly bounded wrt. the program C0LDR_MAP and 

Mi,-.., Ik 

This proves that all LDNF-derivations of the program C0L0R_MAP starting in a well- 
typed query are finite. In particular, all the LDNF-derivations starting in a query 
of the form color_map(a;s, ys), where xs is a list of regions and ys is a list, are finite. 
Note that in proving termination of such queries the choice of a model is irrelevant. 
Moreover, since such queries are well-typed, their input arguments are required to 
have a specified structure, but they arc not required to be ground terms as in the 
case of well-moded queries. Hence, well-typedness allows us to reason about a larger 
class of queries with respect to well-modedness. 

This example is also discussed in (Apt and Pedreschi 1994). In order to prove 
its termination they define a particular level mapping | |, obtained by combining 
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the level mappings of each module, and a special model M wrt. which the whole 
program C0L0R_MAP is acceptable. Both the level mapping | | and the model M are 
non-trivial. 

5 Iterative Proof Method 

In the previous section we have seen how we can exploit properties which are 
preserved by LDNF-resolution, such as well-modedness and well-typedness, for de- 
veloping a modular proof of termination in a hierarchy of programs. In this section 
we show how these properties allow us to apply our general result, i.e., Theorem 9, 
also in an iterative way. 

Corollary 34 

Let P and R be two programs such that P U R is wcll-moded and P extends R, 
and M be a complete model of P U R. Suppose that 

• P is acceptable wrt. a moded level mapping | | and M, 

• for all well-moded queries Q, all LDNF-derivations R U {Q} are finite. 

Then for all well-moded queries Q, all LDNF-derivations of (PUi?)U{Q} are finite. 
Proof 

Let C be the class of well-moded queries of P U R. By Remark 18 and Lemma 19, 
C is (P U i?)-closed. Moreover 

• P is acceptable wrt. a moded level mapping | | and M, by hypothesis; 

• for all well-moded queries Q, all LDNF-derivations of R U {Q} are finite, by 
hypothesis; 

• for all well-moded atoms A, if A is defined in P then A is bounded wrt. | |, 
by Remark 21, since | | is a moded level mapping. 

Hence by Theorem 9 we get the thesis. □ 

Note that this result allows one to incrementally prove well-termination for gen- 
eral programs thus extending the result given in (Etalle et al. 1999) for definite 
programs. 

A similar result can be stated also for well-typed programs and queries, provided 
that there exists a level mapping for P implying boundedness of atomic well-typed 
queries. 

Corollary 35 

Let P and R be two programs such that P U R is well-typed and P extends R, and 
M be a complete model of P U R. Suppose that 

• P is acceptable wrt. a level mapping | | and M, 

• every well- typed atom defined in P is bounded wrt. | |, 

• for all well-typed queries Q, all LDNF-derivations of R U {Q} are finite. 

Then for all well-typed queries Q, all LDNF-derivations of (P\JR) U {Q} are finite. 
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Proof 

Let C be the class of well-typed queries of P U R. By Remark 29 and Lemma 30, C 
is (P U i?)-closed. Moreover 

• P is acceptable wrt. a level mapping | | and M, by hypothesis; 

• for all well- typed queries Q, all LDNF-derivations of R U {Q} arc finite, by 
hypothesis; 

• for all well-typed atoms A, if A is defined in P then A is bounded wrt. | |, by 
hypothesis. 

Hence by Theorem 9 we have the thesis. □ 
Example 36 

Let us consider again the program C0L0R_MAP with the same modes and types as 
in Example 33. We apply the iterative termination proof given by Corollary 35 to 
C0L0R_MAP. 

First step. We can consider at first two trivial modules, R\ := {c8, c9} which 
defines the relation member, and Rq := 0. We already know that 

• i?i is acceptable wrt. any model M and the level mapping | |i already defined; 

• all well-typed atoms A, defined in R\, are bounded wrt. | |i; 

• for all well-typed queries Q, all LDNF-derivations of R U {Q} are trivially 
finite. 

Hence, by Corollary 35, for all well-typed queries Q, all LDNF-derivations of (i?i U 
Ro) U {Q} are finite. 

Second step. We can now iterate the process one level up. Let us consider the 
two modules, i?2 := {c4, c5, c6, c7} which defines the relations select and subset, 
and Ri := {c8, c9} which defines the relation member and it is equal to (i?i U Ro) 
of the previous step. We already showed in Example 33 that 

• i?2 is acceptable wrt. any model M and the level mapping | | 2 already defined; 

• all well-typed atoms A, defined in R2, are bounded wrt. | I2; 

• for all well-typed queries Q, all LDNF-derivations of R\ U {Q} are finite. 

Hence, by Corollary 35, for all well-typed queries Q, all LDNF-derivations of (i?2 U 
i?i) U {Q} are finite. 

By iterating the same reasoning for two steps more, we can prove that all LDNF- 
derivations of the program C0L0R_MAP starting in a well-typed query are finite. 

Our iterative method applies to a hierarchy of programs where on the lowest module, 
R, we require termination wrt. a particular class of queries. This can be a weaker 
requirement on R than acceptability as shown in the following contrived example. 

Example 37 

Let R define the predicate lcount which counts the number of natural numbers in 
a list. 
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lcount(+ : List, — : Nat) 
nat(+ : Any) . 

rl: lcount([ ] ,0) . 

r2: lcount([X|Xs] ,s(N)) ^nat(X), lcount(Xs,N) . 

r3: lcount([X|Xs] ,N) ^-.nat(X), lcount (Xs ,N) . 

r4: lcount (0,N) <— lcount (0 , s (N) ) . 

r5: nat(0) . 

r6: nat(s(N)) ^nat(N). 

R is well-typed wrt. the specified modes and types. Note that R cannot be accept- 
able due to the presence of clause r4. On the other hand, the program terminates 
for all well-typed queries. 

Consider now the following program P which extends R. The predicate split, 
given a list of lists, separates the list elements containing more than max natural 
numbers from the other lists: 

split (+ : ListList, — : ListList, — : ListList) 
>(+ : Nat, + : Nat) 
<=(+ : Nat, + : Nat) 

pi: split ([ ] , [ ] , [ ]) . 

p2: split ( [LlLs] , [LlLl] ,L2) lcount (L,N) , N > max, 

split(Ls,Ll,L2) . 
p3: split ( [LlLs] ,L1, [L I L2] ) <— lcount (L,N) , N <= max, 

split(Ls,Ll,L2) . 

where ListList denotes the set of all lists of lists, and max is a natural number. 
The program P U R is well-typed. Let us consider the simple level mapping | | for 
P defined by: 

\split (IS, 11, 12)\ = |Zs|iength 

which assigns level to any literal not defined in P. Note that 

• P is acceptable wrt. the level mapping | | and any complete model M, 

• all well- typed atoms defined in P are bounded wrt. | |, 

• for all well- typed queries Q, all LDNF-derivations of R U {Q} are finite. 

Hence, by Corollary 35, for all well-typed queries Q, all LDNF-derivations of (P U 
R) U {Q} arc finite. 

This example shows that well-typedness could be useful to exclude what might 
be called "dead code" . 

6 Comparing with Apt and Pedreschi's Approach 

Our work can be seen as an extension of a proposal in (Apt and Pedreschi 1994). 
Hence we devote this section to a comparison with their approach. 

On one hand, since our approach applies to general programs, it clearly covers 
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cases which cannot be treated with the method proposed in (Apt and Pedreschi 
1994), which was developed for definite programs. On the other hand, for definite 
programs the classes of queries and programs which can be treated by Apt and 
Pedreschi's approach are properly included in those which can be treated by our 
method as we show in this section. 

We first recall the notions of semi-acceptability and bounded query used in (Apt 
and Pedreschi 1994). 

Definition 38 {Semi- acceptable Program) 

Let P be a definite program, | | be a level mapping for P and M be a model of 
P. P is called semi- acceptable wrt. \ \ and M if for every clause A <— A, B, B in 
ground (P) such that M \= A 

• \A\ > \B\, iirel(A) ~ rel(B), 

• \A\ > \B\, if rel(A) □ rel(B). 

Definition 39 {Bounded Query) 

Let P be a definite program, | | be a level mapping for P, and M be a model of P. 

• With each query Q := L\,...,L n we associate n sets of natural numbers 
defined as follows: For i G {1, . . . , n}, 

\Q\f = {mi | Li,..., L' n is a ground instance of Q and M \= L[, . . . , L^_J. 

• A query Q is called bounded wrt. \ \ and M if \Q\f ! is finite (i.e., if \Q\^ has 
a maximum in N) for all i € {1, ... , n}. 

Lemma 4-0 

Let P be a definite program which is semi-acceptable wrt. | | and M. If Q is a query 
bounded wrt. | | and M then all LD-descendants of P U {Q} are bounded wrt. | 
and M. 

Proof 

It is a consequence of Lemma 3.6 in (Apt and Pedreschi 1994) and (the proof of) 
Lemma 5.4 in (Apt and Pedreschi 1994). □ 

We can always decompose a definite program P into a hierarchy of n > 1 pro- 
grams P := Ri U . . . U R n , where R n □ . . . □ Ri in such a way that for every 
i e {1, . . . , n} if the predicate symbols and % are both defined in Ri then neither 
Pi □ 9i nor qi □ (either they are mutually recursive or independent). We call 
such a hierarchy a finest decomposition of P. 

The following property has two main applications. First it allows us to compare 
our approach with (Apt and Pedreschi 1994), then it provides an extension of 
Theorem 13 to hierarchies of semi-acceptable programs. 

Proposition 41 

Let P be a semi-acceptable program wrt. a level mapping | | and a model M and 
Q be a query strongly bounded wrt. P and | |. Let P := R\ U . . . U R n be a finest 
decomposition of P into a hierarchy of modules. Let | |j, with i G {1, .. .,n}, be 
defined in the following way: if A is defined in Ri then \A\i = \A\ else \A\i = 0. 
Then 
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• every Ri is acceptable wrt. | |j and M (with i 6 {1, . . . , n}), 

• Q is strongly bounded wrt. R\ U . . . U R n and | |i, . . . , | In- 
Proof 

Immediate by the definitions of semi-acceptability and strongly boundedness, since 
we are considering a finest decomposition. □ 

In order to compare our approach to the one presented in (Apt and Pedreschi 
1994) we consider only Theorem 5.8 in (Apt and Pedreschi 1994), since this is 
their most general result which implies the other ones, namely Theorem 5.6 and 
Theorem 5.7. 

Theorem 42 ( Theorem 5.8 in (Apt and Pedreschi 1994)) 

Let P and R be two definite programs such that P extends R, and let M be a 
model of P U R. Suppose that 

• R is semi-acceptable wrt. | |_r and M n Br, 

• P is semi-acceptable wrt. | |p and M, 

• there exists a level mapping || ||p such that for every ground instance of a 
clause from P, A <— A, B, B, such that M \= A 

— \\A\\ P > \\B\\ P , if rel(B) is defined in P, 

— \\A\\p > \B\ R , if rel(B) is defined in R. 

Then P U R is semi-acceptable wrt. | | and M, where | | is defined as follows: 

\A\ = \A\ P + \\A\\ P , if rel(A) is defined in P, 
\A\ = \A\ R , if rel(A) is defined in R. 

The following remark follows from Lemma 5.4 in (Apt and Pedreschi 1994) and 
Corollary 3.7 in (Apt and Pedreschi 1994). Together with Theorem 42, it implies 
termination of bounded queries in (Apt and Pedreschi 1994). 

Remark 43 

If P U R is semi-acceptable wrt. | | and M and Q is bounded wrt. | | and M then 
all LD-derivations of (P U R) U {Q} are finite. 

We now show that whenever Theorem 42 can be applied to prove termination of 
all the queries bounded wrt. | | and M, then also our method can be used to prove 
termination of the same class of queries with no need of || \\p for relating the proofs 
of the two modules. 

In the following theorem for the sake of simplicity we assume that P □ R is a 
finest decomposition of P U R. We discuss later how to extend the result to the 
general case. 

Theorem 44 

Let P and R be two programs such that P extends i?, and let M be a model of 
PUR. Suppose that 

• R is semi-acceptable wrt. | \p and M n Bp, 

• P is semi-acceptable wrt. | \p and M, 
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• there exists a level mapping || ||p denned as in Theorem 42. 

Let | | be the level mapping defined by Theorem 42. Moreover, suppose P □ R is a 
finest decomposition of P U R. If Q is bounded wrt. | |, then Q is strongly bounded 
wrt. PUR and | |p and | |p. 

Proof 

Since we are considering a finest decomposition of F U fl, by Proposition 41, R is 
acceptable wrt. | |p, while P is acceptable wrt. | \' p such that if A is defined in P 
then \A\' P = \A\ P else \A\' P = 0. 

By Lemma 40 all LD-descendants of (P U R) U {Q} are bounded wrt. | | and M. 
By definition of boundedness, for all LD-descendants Q' of (PUP) U {Q} 7 first(Q') 
is bounded wrt. |. By definition of | |, for all atoms A bounded wrt. | | we have 
that: if A is defined in R then A is bounded wrt. | |p, while if A is defined in P 
then A is bounded wrt. | |p and hence wrt. | \' p (since \A\' P = \A\p). Hence the 
thesis follows. □ 

If the hierarchy P □ P is not a finest one and | |p and | \r are the level mappings 
corresponding to P and P respectively, then we can decompose P into a finest 
decomposition, P := P n □ . . . □ Pi , and consider instead of | |p the derived level 
mappings | \p i defined in the following way: if A is defined in Pi then \A\p i — \A\p 
else \A\p i = 0. Similarly we can decompose P := P„ □ . . . □ Pi and define the 
corresponding level mappings. The derived level mappings satisfy all the properties 
we need for proving that if Q is bounded wrt. | |, then Q is strongly bounded wrt. 
PUP and | \ Pl ,...,\ |p„,| \ Rl ,...,\ |p„. 

To complete the comparison with (Apt and Pedreschi 1994), we can observe 
that our method is applicable also for proving termination of queries in modular 
programs which are not (semi-)acceptable. Such programs clearly cannot be dealt 
with Apt and Pedreschi's method. The program of Example 37 is a non-acceptable 
program for which we proved termination of all well-typed queries by applying 
Corollary 35. The following is a simple example of a non- acceptable program to 
which we can apply the general Theorem 13. 

Example 4-5 

Let R be the following trivial program: 
rl: q(0). 

r2: q(s(Y)) <- q(Y) . 

The program R is acceptable wrt. the following natural level mapping | |p and 
any model M: 

h(t)\ R = \t\si Z e- 

Let P be a program, which extends P, defined as follows: 

pi: r(0,0). 

p2: r(s(X),Y). 

p3: p(X) «-r(X,Y), q(Y) . 
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The program P is acceptable wrt. the following trivial level mapping | \p and 
any model M: 

|q(»)|p = o, 
\ T (x, y)\ P = o, 

\p(x)\ P = 1. 

Note that, even if each module is acceptable, PUR cannot be acceptable wrt. 
any level mapping and model. In fact P U R is not left-terminating: for example 
it does not terminate for the ground query p(s(0)). As a consequence Apt and 
Pedreschi's method does not apply to P U R. On the other hand, there are ground 
queries, such as p(0) , which terminate in P U R. We can prove it as follows. 

• By Theorem 13, for all strongly bounded queries Q wrt. PUR and | \p, | |p, 
all LD-derivations of (P U R) U {Q} are finite. 

• p(0) is strongly bounded wrt. PUR and | \p, | \p. In fact, Co/Z(p u ^)(p(0)) = 
{p(0),r(0,Y),q(0)} and all these atoms are bounded wrt. their correspond- 
ing level mapping. 

7 Conclusions 

In this paper we propose a modular approach to termination proofs of general pro- 
grams by following the proof style introduced by Apt and Pcdrcschi. Our technique 
allows one to give simple proofs in hierarchically structured programs, namely pro- 
grams which can be partitioned into n modules, Ri U . . . U R n , such that for all 
i G {1, . . . , n — 1}, Ri+i extends R\ U . . . U Ri. 

We supply the general Theorem 9 which can be iteratively applied to a hierarchy 
of two programs and a class of queries enjoying persistence properties through 
LDNF-resolution. We then use such a result to deal with a general hierarchy of 
acceptable programs, by introducing an extension of the concept of boundedness 
for hierarchical programs, namely strong boundedness. Strong boundedness is a 
property on queries which can be easily ensured for hierarchies of programs behaving 
well, such as well-modcd or well-typed programs. We show how specific and simple 
hierarchical termination proofs can be derived for such classes of programs and 
queries. We believe this is a valuable proof technique since realistic programs are 
typically well-moded and well-typed. 

The simplifications in the termination proof derive from the fact that for proving 
the termination of a modular program, we simply prove acceptability of each module 
by choosing a level mapping which focuses only on the predicates defined in it, with 
no concern of the module context. Generally this can be done by using very simple 
and natural level mappings which are completely independent from one module 
to another. A complicated level mapping is generally required when we prove the 
termination of a program as a whole and we have to consider a level mapping which 
appropriately relates all the predicates defined in the program. Hence the finer the 
modularization of the program the simpler the level mappings. Obviously we cannot 
completely ignore how predicates defined in different modules relate to each other. 
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On one hand, when we prove acceptability for each module, we consider a model for 
the whole program. This guarantees the compatibility among the definitions in the 
hierarchy. On the other hand, for queries we use the notion of strong boundcdness. 
The intuition is that we consider only what may influence the evaluation of queries 
in the considered class. 

The proof method of Theorem 9 can be applied also to programs which arc not 
acceptable. In fact, the condition on the lower module is just that it terminates on 
all the queries in the considered class and not on all ground queries as required for 
acceptable programs. From Theorem 9 we could also derive a method to deal with 
pre-compiled modules (or even modules written in a different language) provided 
that we already know termination properties and we have a complete specification. 

For sake of simplicity, in the first part of the paper we consider the notion of 
acceptability instead of the less requiring notion of semi-acceptability. This choice 
makes proofs of our results much simpler. On the other hand, as we show in Section 
6, our results can be applied also to hierarchies of semi-acceptable programs. 

We have compared our proposal with the one in (Apt and Pedreschi 1994). They 
propose a modular approach to left-termination proofs in a hierarchy of two definite 
programs P □ R. They require both the (semi)-acceptability of the two modules R 
and P wrt. their respective level mappings and a condition relating the two level 
mappings which is meant to connect the two termination proofs. 

Our method is more powerful both because we consider also general programs 
and because we capture definite programs and queries which cannot be treated by 
the method developed in (Apt and Pedreschi 1994). In fact there are non-acceptable 
programs for which we can single out a class of terminating queries. 

For the previous reasons our method improves also with respect to (Pedreschi 
and Ruggieri 1996, Pedreschi and Ruggieri 1999) where hierarchies of modules are 
considered. In (Pedreschi and Ruggieri 1996, Pedreschi and Ruggieri 1999) a unify- 
ing framework for the verification of total correctness of logic programs is provided. 
The authors consider modular termination by following the approach in (Apt and 
Pedreschi 1994). 

In (Marchiori 1996) a methodology for proving termination of general logic pro- 
grams is proposed which is based on modularization. In this approach, the acyclic 
modules, namely modules that terminate independently from the selection rule, play 
a distinctive role. For such modules, the termination proof does not require a model. 
In combination with appropriate notions of up- acceptability and low- acceptability for 
the modules which are not acyclic, this provides a practical technique for proving 
termination of the whole program. Analogously to (Apt and Pedreschi 1994), also in 
(Marchiori 1996) a relation between the level mappings of all modules is required. It 
is interesting to note that the idea of exploiting acyclicity is completely orthogonal 
to our approach: we could integrate it into our framework. 

Another related work is (Decorte et al. 1999), even if it does not aim explicitly at 
modularity. In fact they propose a technique for automatic termination analysis of 
definite programs which is highly efficient also because they use a rather operational 
notion of acceptability with respect to a set of queries, where decreasing levels are 
required only on (mutually) recursive calls as in (De Schreye et al. 1992). Effectively, 
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this corresponds to considering a finest decomposition of the program and having 
independent level mappings for each module. However, their notion of acceptability 
is defined and verified on call-patterns instead of program clauses. In a sense, such 
an acceptability with respect to a set of queries combines the concepts of strongly 
boundedness and (standard) acceptability. They start from a class of queries and 
try to derive automatically a termination proof for such a class, while we start from 
the program and derive a class of queries for which it terminates. 

In (Verbaeten et al. 1999) termination in the context of tabled execution is con- 
sidered. Also in this case modular results are inspired by (De Schreye et al. 1992) 
by adapting the notion of acceptability wrt. call-patterns to tabled executions. This 
work is further developed in (Verbaeten et al. 2001) where their modular termina- 
tion conditions are refined following the approach by (Apt and Pedreschi 1994). 

In (Etallc et al. 1999) a method for modular termination proofs for well-moded 
definite programs is proposed. Our present work generalizes such result to general 
programs. 

Our method may help in designing more powerful automatic systems for veri- 
fying termination (De Schreye et al. 1992, Speirs, Somogyi and S0ndergaard. 1997, 
Decorte et al. 1999, Codish and Taboch 1999). We see two directions which could 
be pursued for a fruitful integration with existing automatic tools. The first one ex- 
ploits the fact that in each single module it is sufficient to synthesize a level mapping 
which does not need to measure atoms defined in other modules. The second one 
concerns tools based on call-patterns analysis (De Schreye et al. 1992, Gabbriclli 
and Giacobazzi 1994, Codish and Dcmoen 1995). They can take advantage of the 
concept of strong boundedness which, as we show, can be implied by well-behavior 
of programs (Debray and Warren 1988, Debray 1989). 
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